Received-SPF: pass (google.com: domain of oss-security-return-30108-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Feedback-ID: i787e41f1:Fastmail
Date: Thu, 2 May 2024 11:13:56 +0200
From: Greg KH <greg@kroah.com>
To: oss-security@lists.openwall.com
Message-ID: <2024050229-overrun-crowbar-7f89@gregkh>
References: <7e78b8d8-860c-47f5-bbec-a967c277d539@oracle.com>
 <2661c15d-52d3-41b7-a725-cc66c2094ba4@oracle.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <2661c15d-52d3-41b7-a725-cc66c2094ba4@oracle.com>
Subject: Re: [oss-security] Re: CVEs issued by the Linux kernel CNA

On Wed, May 01, 2024 at 01:27:06PM -0700, Alan Coopersmith wrote:
> On 2/20/24 15:30, Alan Coopersmith wrote:
> > As recently announced [1], kernel.org is now a CNA for the Linux kernel, and
> > today issued its first 8 CVEs, as seen in the archives of their mailing list
> > at https://lore.kernel.org/linux-cve-announce/ .
> > 
> > Their documentation [2] warns that we should expect a "seemingly large number
> > of CVEs that are issued by the Linux kernel team".
> 
> Quantifying this a bit more now - Greg K-H provided some stats so far in:
> https://social.kernel.org/notice/AhSCMVs4RofbnTftGS
> 
> which says:
> 
> > Year Reserved Assigned Rejected Total
> > 2019:   47        2        1      50
> > 2020:   37       13        0      50
> > 2021:   39      304        7     350
> > 2022:    7       43        0      50
> > 2023:   60      180       10     250
> > 2024:  107      435        8     550
> > Total: 297      977       26    1300
> > 
> > 
> > Anything older than 2023 is us back-filling in from the GSD database, and we
> > still have a long way to go for there. Some 2023 ones are in there too from
> > GSD, but mostly not, all of 2024 is since we took over being a CNA.

And, if anyone wants to play along at home, they can get the same
information directly from our git repo at:
	https://git.kernel.org/pub/scm/linux/security/vulns.git/
by cloning it locally and then running:

	$ ./scripts/summary
	 Year	Reserved	Assigned	Rejected	Total
	  2019:    47	            2	            1	           50
	  2020:    37	           13	            0	           50
	  2021:    39	          304	            7	          350
	  2022:     7	           43	            0	           50
	  2023:    60	          180	           10	          250
	  2024:   107	          435	            8	          550
	 Total:   297	          977	           26	         1300

No need for anyone to rely on random updates from me on
social.kernel.org for that type of thing.

thanks,

greg k-h